What is the CRT file format?
Security certificates used by secure websites are saved on the server to enable encrypted connections in files with the .crt extension. Security certificates allow secure data transfer, login authentication, payments, and safe web browsing. .crt files conform to the PEM standard or use binary DER encoding - the extension alone does not tell you which format is in use.
.crt file structure
.crt files adhere to the X.509 certificate standard and may use one of two encodings. The more common PEM form uses Base64 ASCII text. Each PEM-encoded .crt file contains the following:
- header:
-----BEGIN CERTIFICATE----- - Base64-encoded DER certificate data
- footer:
-----END CERTIFICATE-----
Binary .crt files use raw DER encoding and begin with the ASN.1 SEQUENCE bytes 0x30 0x82. To tell them apart, open the file in a text editor - PEM is human-readable, DER is not.
.crt files for websites
.crt files are stored server-side. A website with a valid TLS/SSL certificate, issued by a trusted certificate authority such as DigiCert or Let's Encrypt, will be trusted by the browser, which indicates this with a padlock icon in the address bar. Users can inspect the certificate to view the holder's identity and expiration date. .crt files are interchangeable with .cer files - .crt is the common convention on Unix/Linux and Apache servers, while .cer is more common on Windows. A .crt holds only the public certificate; the matching private key is stored separately in a .key or .pfx file.
Security & safety
RISK: LOWA .crt normally contains only a PUBLIC certificate - it's safe to view and share, and can't execute. The real caution is about TRUST, not malware: installing a certificate into your trust store tells your system to trust whoever it identifies, so only install a root/CA certificate from a source you trust (an unexpected 'install this certificate' request can be an attempt to intercept your encrypted traffic). Also don't confuse a .crt (public) with a .pfx/.p12 or a .key/.pem private key, which ARE secret and must never be shared or uploaded to online converters. Check a certificate's issuer and expiry before relying on it, and inspect/convert locally with OpenSSL rather than online certificate tools.
Format details
in a nutshellPrograms that open CRT files
Windows3 apps
OpenSSL
Open-source Inspect: 'openssl x509 -in cert.crt -text -noout' (add -inform der for a binary .crt). Convert DER<->PEM and bundle into .pfx. The universal certificate tool.
Windows Crypto Shell / certmgr (built-in)
Built-in Double-click the .crt to open the certificate viewer (issuer, validity, purpose). Click 'Install Certificate' to add it to the store, or manage via certmgr.msc.
Notepad / any text editor
Open-source Open the .crt as text: if you see '-----BEGIN CERTIFICATE-----' it's PEM (readable Base64); if it's binary gibberish it's DER. Helps decide how to convert it. 
macOS2 apps
Keychain Access (built-in)
Built-in Double-click the .crt to view it and import/trust it in the keychain. macOS shows issuer, validity and trust settings.
OpenSSL / LibreSSL
Open-source In Terminal: 'openssl x509 -in cert.crt -text -noout' to inspect, or convert formats. Pre-installed on macOS (LibreSSL). 
Linux2 apps
OpenSSL
Open-source Pre-installed: 'openssl x509 -in cert.crt -text -noout' (add -inform der for binary), or convert DER<->PEM for Apache/Nginx. The standard way to handle certificates.
GNOME/KDE certificate viewers
Built-in Double-click a .crt in the file manager to open the desktop certificate viewer, or import it into the system trust store (update-ca-certificates). Technical details
deep spec| Encoding | Binary (DER) or Base64 text (PEM) - the .crt extension does not indicate which; open in a text editor to distinguish |
| MIME type | application/x-x509-ca-cert (primary); also application/pkix-cert and application/x-x509-user-cert |
| Container structure | ASN.1 DER SEQUENCE encoding subject, issuer, public key, validity period, v3 extensions (SANs, key usage) and the CA's digital signature |
| PEM marker | Text line -----BEGIN CERTIFICATE----- at file start (ASCII/UTF-8) |
| DER magic bytes | 0x30 0x82 at offset 0 - ASN.1 SEQUENCE tag followed by a 2-byte length |
| Certificate version | X.509 v1, v2 or v3; v3 is universal in modern use and required for Subject Alternative Names and key usage extensions |
| Certificate content | Public certificate only - subject name, issuer, public key, validity dates and CA signature; private key is never stored here |
| Signature algorithm | Typically sha256WithRSAEncryption or ecdsa-with-SHA256; older files may carry sha1WithRSAEncryption (deprecated and rejected by modern browsers) |
| Integrity mechanism | CA digital signature over TBSCertificate; any byte change invalidates the signature and causes TLS handshake failure |
| Typical file size | 1 KB - 4 KB for a single certificate; several KB larger when a full certificate chain is concatenated |
| Compression | None - certificate data is stored uncompressed |
| Encryption | None - the certificate is intentionally public; private keys require .key, .pfx or .p12 files |
| Platform support | Windows, macOS, Linux, Android, iOS and any TLS-capable system or runtime |
| Common uses | HTTPS/TLS server authentication, code signing, email encryption (S/MIME), client certificate authentication |
| Interchangeable extensions | .crt (Unix/Linux/Apache convention) and .cer (Windows convention) name the same X.509 format; .pem and .der name the encoding explicitly |
| Released | X.509 first published 1988 (ITU-T); .crt is a long-standing certificate extension on Unix/Apache |
| Latest version | X.509 v3 (RFC 5280, 2008); PEM text encoding codified in RFC 7468 (2015) |
| Open standard | Yes · royalty-free |
| Specification | datatracker.ietf.org |
CRT conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about CRT files.
